omp-conductor 0.4.2 → 0.4.3

package/src/failure-class.ts

@@ -0,0 +1,172 @@
+/**
+ * Why a run ended badly, and what to do about it (#132).
+ *
+ * Half of this fleet's spend produced no merged PR, and every one of those runs
+ * ended at a human who then re-derived the same triage by hand: read the row,
+ * read the PR's checks, decide whether to requeue, re-run, settle or escalate —
+ * and then threw the conclusion away. The daemon already knew *that* a run ended
+ * badly; it never recorded *why*, so a mechanical recovery cost human attention
+ * and an implementation budget it had not spent.
+ *
+ * This module is the "why", and nothing else: pure, synchronous, and given the
+ * facts rather than fetching them. The caller gathers what the row needs (a PR
+ * state, a mergeability, a check list), classifies, then performs the one
+ * recovery the class names. Keeping the decision table here is what makes "one
+ * green test per class" possible without a daemon, a tracker or a network.
+ */
+
+import type { FailureClass, RecoveryAction, RunRecord } from "./types.ts";
+
+/** Facts the caller fetched, each only for the rows that need it. */
+export interface ClassifyFacts {
+  pr?: "open" | "merged" | "closed";
+  mergeable?: "conflicting" | "clean" | "unknown";
+  checks?: { name: string; state: string; link?: string }[];
+}
+
+export interface Classification {
+  cls: FailureClass;
+  recovery: RecoveryAction;
+  /** One line naming the signals that matched, carried into the escalation. */
+  evidence: string;
+}
+
+/**
+ * Check states GitHub reports for a run that never produced a verdict.
+ *
+ * Infrastructure, not code: a cancelled or timed-out check says nothing about
+ * the diff, so re-running it is free information and charging an implementation
+ * attempt for it is simply wrong. Compared lowercased because `gh pr checks
+ * --json state` has emitted both spellings across versions.
+ */
+const INFRA_CHECK_STATES: Record<string, true> = {
+  cancelled: true,
+  timed_out: true,
+  startup_failure: true,
+  stale: true,
+  skipped: true,
+};
+
+/** States that mean "this check has a verdict and it is good". */
+const SUCCESS_CHECK_STATES: Record<string, true> = { success: true, neutral: true };
+
+function normalise(state: string): string {
+  return state.trim().toLowerCase();
+}
+
+/**
+ * Classify one terminal run.
+ *
+ * First match wins, and the order is the contract: the earlier a row matches,
+ * the less its raw state matters. `settlement-stuck` leads because a merged PR
+ * makes every other reading of the row wrong — that is the #362 case, where a
+ * `pushed-green` row outlived its own PR and held the issue out of dispatch.
+ */
+export function classifyRun(run: RunRecord, facts: ClassifyFacts): Classification {
+  const hasArtifacts = run.prUrl !== undefined || run.headSha !== undefined || run.salvageSha !== undefined;
+
+  // The PR landed while the row says otherwise. Whatever else is true about this
+  // run, it succeeded, and the recovery is bookkeeping.
+  if (run.prUrl !== undefined && facts.pr === "merged") {
+    return {
+      cls: "settlement-stuck",
+      recovery: "settle",
+      evidence: `row state ${run.state} but ${run.prUrl} is merged`,
+    };
+  }
+
+  // A green PR whose base moved under it. Mechanical to fix and it never spent
+  // an implementation attempt: veltro#365 lost a continuation to exactly this.
+  if (run.state === "pushed-green" && facts.pr === "open" && facts.mergeable === "conflicting") {
+    return {
+      cls: "merge-conflict",
+      recovery: "continue",
+      evidence: `${run.prUrl ?? "the PR"} is open and conflicting — the base moved under a green PR`,
+    };
+  }
+
+  if (run.state === "blocked") {
+    return {
+      cls: "question",
+      recovery: "escalate",
+      evidence: run.lastError ?? "the worker stopped to ask a question and left no report",
+    };
+  }
+
+  if (run.state === "orphaned") {
+    // Dirty means the worktree holds the only copy: re-claiming would delete it,
+    // which is the #319 data-loss shape. The existing unsalvaged-WIP admission
+    // hold already fails dispatch closed, so recording the class is the whole
+    // recovery — an operator has to look either way.
+    if (run.salvageError !== undefined && run.salvageAckAt === undefined) {
+      return {
+        cls: "orphan-dirty",
+        recovery: "hold",
+        evidence: `uncommitted work in ${run.worktree} is the only copy: ${run.salvageError}`,
+      };
+    }
+    return {
+      cls: "orphan-clean",
+      recovery: "requeue",
+      evidence: `daemon died holding the claim; nothing uncommitted (${run.branch})`,
+    };
+  }
+
+  if (run.state === "killed") {
+    if (run.turns >= run.maxTurns) {
+      return hasArtifacts
+        ? {
+            cls: "turn-cap-progress",
+            recovery: "continue",
+            evidence: `turns ${run.turns}/${run.maxTurns} with work to continue from (${run.prUrl ?? run.salvageSha ?? run.headSha})`,
+          }
+        : {
+            cls: "turn-cap-spinning",
+            recovery: "escalate",
+            evidence: `turns ${run.turns}/${run.maxTurns}, no PR, no commits — $${run.spendUsd.toFixed(2)} spent`,
+          };
+    }
+    // Below its own ceiling, so nothing this worker did ended it: a daemon
+    // restart, a drain, an operator. Costs no budget and needs no human.
+    return {
+      cls: "admin-kill",
+      recovery: "requeue",
+      evidence: `killed at ${run.turns}/${run.maxTurns} turns — under its own ceiling, so not a cap kill`,
+    };
+  }
+
+  if (run.state === "failed" && facts.pr === "open") {
+    const checks = facts.checks ?? [];
+    const unresolved = checks.filter((c) => !SUCCESS_CHECK_STATES[normalise(c.state)] === true);
+    if (checks.length > 0 && unresolved.length > 0) {
+      const failing = unresolved.filter((c) => normalise(c.state) === "failure");
+      if (failing.length > 0) {
+        return {
+          cls: "ci-deterministic",
+          recovery: "escalate",
+          evidence: `checks failed: ${failing
+            .map((c) => `${c.name}${c.link === undefined ? "" : ` (${c.link})`}`)
+            .join(", ")}`,
+        };
+      }
+      if (unresolved.every((c) => INFRA_CHECK_STATES[normalise(c.state)] === true)) {
+        return {
+          cls: "ci-infra",
+          recovery: "rerun-checks",
+          evidence: `no check reached a verdict: ${unresolved.map((c) => `${c.name} ${normalise(c.state)}`).join(", ")}`,
+        };
+      }
+    }
+  }
+
+  // Deliberately escalate rather than retry. An unrecognised shape is a gap in
+  // this table, and a silent requeue would spend a budget on a cause nobody has
+  // named — the exact behaviour #132 exists to end.
+  return {
+    cls: "unknown",
+    recovery: "escalate",
+    evidence: `state ${run.state}, turns ${run.turns}/${run.maxTurns}, pr ${facts.pr ?? "unknown"}${
+      run.lastError === undefined ? "" : `, last error: ${run.lastError}`
+    }`,
+  };
+}

package/src/fleet.ts

@@ -31,7 +31,10 @@ import { findProject, loadConfig, resolveCredentials, stateDir } from "./config.
 import { describeBoundary, probeHost } from "./credentials.ts";
 import { planUsageLine, readPlanUsage, sharedUsageSource } from "./usage.ts";
 import { readApprovalSurface } from "./approval-surface.ts";
-import { confinementRefusalsToday, type ConfinementRefusalSummary } from "./confinement.ts";
+import { inspectBriefLayout } from "./brief-upgrade.ts";
+import { dbPath, openStore } from "./store.ts";
+import { renderBriefForProject } from "./setup.ts";
+import type { ProjectConfig, Store } from "./types.ts";
 import { settlementFlagSummary } from "./diff-flags.ts";
 import { probeCodeGraph, type CodeGraphHealth } from "./graph-health.ts";
 import { formatOpenReports } from "./reports.ts";
@@ -128,7 +131,14 @@ export interface ArmResult {
 
 export interface ArmDeps {
   sendChallenge?: (token: string, owner: string, text: string) => Promise<void>;
-  waitForUserTurn?: (transcript: string, code: string, timeoutMs: number) => Promise<boolean>;
+  /**
+   * Waits for the challenge to appear as a user turn somewhere under the
+   * session directory. The waiter owns transcript discovery — not the caller —
+   * because the reply may land in a session that starts *after* the send, so a
+   * path resolved before the challenge went out can be the wrong file by the
+   * time the operator answers (#142).
+   */
+  waitForUserTurn?: (dir: string, code: string, sentAt: number, timeoutMs: number) => Promise<boolean>;
   now?: () => number;
   sleep?: (ms: number) => Promise<void>;
   timeoutMs?: number;
@@ -167,11 +177,11 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
     );
   }
 
-  const transcript = newestSessionTranscript(tick.cwd);
-  if (transcript === undefined) {
+  const dir = sessionDirForCwd(tick.cwd);
+  if (!existsSync(dir)) {
     throw new Error(
-      `no orchestrator session transcript under ${sessionDirForCwd(tick.cwd)} — ` +
-        `the inbound proof is read from a user turn there. Start the pane orchestrator, let it settle, then arm again`,
+      `no orchestrator session directory at ${dir} — ` +
+        `the inbound proof is read from a user turn in a transcript there. Start the pane orchestrator, let it settle, then arm again`,
     );
   }
 
@@ -183,6 +193,9 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
     `Nothing will be dispatched until that reply is seen in the orchestrator session.`;
 
   const send = deps.sendChallenge ?? sendTelegramMessage;
+  // Read before the send, not after: a transcript untouched since this instant
+  // cannot contain the reply, and that is what the waiter filters on.
+  const sentAt = (deps.now ?? Date.now)();
   try {
     await send(token, channel.owner, text);
   } catch (err) {
@@ -192,9 +205,16 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
   }
 
   const timeoutMs = deps.timeoutMs ?? ARM_CHALLENGE_TIMEOUT_MS;
-  const wait = deps.waitForUserTurn ?? ((tr, c, ms) => waitForChallengeInTranscript(tr, c, ms, deps));
-  const seen = await wait(transcript, code, timeoutMs);
-  if (!seen) {
+  const injected = deps.waitForUserTurn;
+  const scan: SessionScan = injected
+    ? { seen: await injected(dir, code, sentAt, timeoutMs), scanned: [], ignored: [] }
+    : await waitForChallengeInSessions(dir, code, sentAt, timeoutMs, deps);
+  if (!scan.seen) {
+    const listing = [
+      `session dir: ${dir}`,
+      ...scan.scanned.map((f) => `  watched: ${f}`),
+      ...scan.ignored.map((f) => `  ignored (stale, last written before the challenge): ${f}`),
+    ].join("\n");
     throw new Error(
       `arm: the challenge never arrived as a user turn in time — NOT armed.\n` +
         `Inbound Telegram is not reaching the omp session. Check, in order:\n` +
@@ -202,7 +222,7 @@ export async function armTicks(projectName?: string, deps: ArmDeps = {}): Promis
         `  * is another process holding this bot token? Telegram allows exactly one\n` +
         `    getUpdates consumer and rejects the second with HTTP 409.\n` +
         `  * did you reply in the DM with the bot, not another chat?\n` +
-        `transcript: ${transcript}`,
+        listing,
     );
   }
 
@@ -953,8 +973,10 @@ export function formatFleetStatus(
   telegram: TelegramHealth = { kind: "unprobed" },
   now = Date.now(),
   codeGraph: CodeGraphHealth = { configured: false },
-  refusals: ConfinementRefusalSummary | undefined = undefined,
   boundary: BoundaryStatus | undefined = undefined,
+  brief: string | undefined = undefined,
+  decisions: string | undefined = undefined,
+  failureClasses: string | undefined = undefined,
 ): string {
   const tickLine =
     layers.ticksDetail === undefined
@@ -1007,14 +1029,6 @@ export function formatFleetStatus(
   }
 
   const graphBlock = formatCodeGraphHealth(codeGraph, now);
-  // Silent when there were none: a line reading "0" every day is one nobody
-  // reads on the day it says 40. A repeatedly-refused orchestrator is
-  // misbriefed, and that is the operator's problem to see (#127).
-  const confinementLine =
-    refusals === undefined
-      ? undefined
-      : `confine   ${refusals.count} orchestrator refusal(s) today  ` +
-        `(latest: ${refusals.latest.tool} ${refusals.latest.path} — ${refusals.latest.kind})`;
   // Reported every time, never only when it is bad. An operator reading this
   // has to be able to see "unprotected" on the day they assumed otherwise, and
   // a line that appears only in the failure case is one whose absence means
@@ -1034,7 +1048,9 @@ export function formatFleetStatus(
     herdrLine,
     telegramLine,
     ...boundaryLines,
-    ...(confinementLine === undefined ? [] : [confinementLine]),
+    ...(brief === undefined ? [] : [brief]),
+    ...(decisions === undefined ? [] : [decisions]),
+    ...(failureClasses === undefined ? [] : [failureClasses]),
     ...(graphBlock === undefined ? [] : [graphBlock]),
     daemonBlock,
     "",
@@ -1133,10 +1149,17 @@ export async function renderStatus(projectName?: string): Promise<string> {
   const boundary =
     live ?? {
       ...describeBoundary(credentials.isolation, await probeHost({ slots: s.caps.maxConcurrentWorkers })),
-      detail: [
-        "No daemon is running, so this is THIS SHELL's view, not the fleet's — an interactive shell holds",
-        "none of the unit's capabilities. Start the daemon and re-read before concluding anything.",
-      ],
+      detail:
+        rec === undefined
+          ? [
+              "No daemon is running, so this is THIS SHELL's view, not the fleet's — an interactive shell",
+              "holds none of the unit's capabilities. Start the daemon and re-read before concluding anything.",
+            ]
+          : [
+              "The daemon did not report a boundary (it predates the field), so this is THIS SHELL's view,",
+              "not the fleet's — an interactive shell holds none of the unit's capabilities. Upgrade and",
+              "restart the daemon before concluding anything.",
+            ],
     };
   return formatFleetStatus(
     { ...s, planUsage },
@@ -1145,11 +1168,88 @@ export async function renderStatus(projectName?: string): Promise<string> {
     telegram,
     Date.now(),
     codeGraph,
-    confinementRefusalsToday(),
     boundary,
+    briefStatusLine(project),
+    decisionStatusLine(project.name),
+    failureClassBlock(project.name),
   );
 }
 
+/**
+ * One line naming the brief layout, or nothing when it cannot be read.
+ *
+ * `brief-upgrade` stays the verb that migrates a legacy layout — this is the
+ * surface that tells an operator they still have one, in the place they already
+ * look (#131). Silent on any throw: a status that cannot render because the
+ * brief moved is worse than a status missing one row.
+ */
+function briefStatusLine(project: ProjectConfig): string | undefined {
+  try {
+    const layout = inspectBriefLayout(project.workspaceRoot, renderBriefForProject(project));
+    return layout.kind === "overlay"
+      ? "brief     overlay (package floor + POLICY.md)"
+      : `brief     ${layout.kind} — run omp-conductor brief-upgrade`;
+  } catch {
+    return undefined;
+  }
+}
+
+/**
+ * Unrecovered runs grouped by failure class (#132), or nothing when there are
+ * none.
+ *
+ * Reported as classes rather than as row states because a row state is not an
+ * issue state: the FAILED column counted four completed issues on this fleet
+ * while the genuinely stuck ones were invisible (#109). A class says which of
+ * those it is, and `recoveredAt` is what keeps a recovered row out of the list.
+ */
+function failureClassBlock(projectName: string): string | undefined {
+  const path = dbPath();
+  if (!existsSync(path)) return undefined;
+  let store: Store | undefined;
+  try {
+    store = openStore(path);
+    const counts = store.failureClassCounts(projectName);
+    if (counts.length === 0) return undefined;
+    return [
+      "failure classes (unrecovered)",
+      ...counts.map((c) => `  ${c.cls.padEnd(18)}${c.n}`),
+    ].join("\n");
+  } catch {
+    return undefined;
+  } finally {
+    store?.close();
+  }
+}
+
+/**
+ * One line naming what the orchestrator still owes its operator (#136).
+ *
+ * Reported whenever the store exists, `none open` included: a row that appears
+ * only when something is outstanding is a row whose absence means nothing, and
+ * "did it forget to record the question, or is there genuinely none?" is exactly
+ * the ambiguity this ledger exists to remove. Omitted on any throw — a status
+ * that fails to render because the store is mid-migration is worse than one
+ * missing a row.
+ */
+function decisionStatusLine(projectName: string): string | undefined {
+  const path = dbPath();
+  if (!existsSync(path)) return undefined;
+  let store: Store | undefined;
+  try {
+    store = openStore(path);
+    const open = store.openDecisions(projectName);
+    if (open.length === 0) return "decisions none open";
+    const oldest = open[0]!;
+    const hours = Math.max(0, Math.round((Date.now() - oldest.askedAt) / 3_600_000));
+    return `decisions ${open.length} open (oldest ${hours}h)`;
+  } catch {
+    return undefined;
+  } finally {
+    store?.close();
+  }
+}
+
 // ---------------------------------------------------------------------------
 // arm proof helpers
 // ---------------------------------------------------------------------------
@@ -1267,23 +1367,6 @@ export function sessionDirForCwd(cwd: string): string {
   return join(home, ".omp", "agent", "sessions", slug.replaceAll("/", "-"));
 }
 
-function newestSessionTranscript(cwd: string): string | undefined {
-  const dir = sessionDirForCwd(cwd);
-  if (!existsSync(dir)) return undefined;
-  let best: { path: string; mtime: number } | undefined;
-  for (const name of readdirSync(dir)) {
-    if (!name.endsWith(".jsonl")) continue;
-    const path = join(dir, name);
-    try {
-      const mtime = statSync(path).mtimeMs;
-      if (best === undefined || mtime > best.mtime) best = { path, mtime };
-    } catch {
-      /* race */
-    }
-  }
-  return best?.path;
-}
-
 function makeChallengeCode(): string {
   const bytes = new Uint8Array(4);
   crypto.getRandomValues(bytes);
@@ -1301,20 +1384,66 @@ async function sendTelegramMessage(token: string, owner: string, text: string):
   }
 }
 
-async function waitForChallengeInTranscript(
-  transcript: string,
+interface SessionScan {
+  seen: boolean;
+  /** `name (mtime <iso>)` for every transcript the last pass actually parsed. */
+  scanned: string[];
+  /** Same shape, for the ones skipped as written before the challenge. */
+  ignored: string[];
+}
+
+/**
+ * Polls the session directory — re-read on every pass, never snapshotted —
+ * until the challenge shows up as a user turn or the deadline passes.
+ *
+ * Discovery lives here because the reply can land in a transcript that does not
+ * exist yet when the challenge is sent: a rotated session, or the first one of
+ * a pane started right after arming (#142). A waiter handed one path polls a
+ * file the answer will never be written to, and arming becomes impossible.
+ *
+ * Files untouched since just before the send are named, not parsed: an append
+ * bumps mtime, so a transcript older than the challenge cannot hold the reply,
+ * and skipping it keeps a large stale session out of every 5 s pass.
+ */
+async function waitForChallengeInSessions(
+  dir: string,
   code: string,
+  sentAt: number,
   timeoutMs: number,
   deps: ArmDeps,
-): Promise<boolean> {
+): Promise<SessionScan> {
   const now = deps.now ?? Date.now;
   const sleep = deps.sleep ?? ((ms: number) => new Promise<void>((r) => setTimeout(r, ms)));
   const deadline = now() + timeoutMs;
-  while (now() < deadline) {
-    if (await transcriptHasUserCode(transcript, code)) return true;
+  for (;;) {
+    const scanned: string[] = [];
+    const ignored: string[] = [];
+    let names: string[] = [];
+    try {
+      names = readdirSync(dir);
+    } catch {
+      /* the directory can go away under a rotation; the next pass re-reads it */
+    }
+    for (const name of names.sort()) {
+      if (!name.endsWith(".jsonl")) continue;
+      const path = join(dir, name);
+      let mtimeMs: number;
+      try {
+        mtimeMs = statSync(path).mtimeMs;
+      } catch {
+        continue; /* race */
+      }
+      const label = `${name} (mtime ${new Date(mtimeMs).toISOString()})`;
+      if (mtimeMs < sentAt - 1_000) {
+        ignored.push(label);
+        continue;
+      }
+      scanned.push(label);
+      if (await transcriptHasUserCode(path, code)) return { seen: true, scanned, ignored };
+    }
+    if (now() >= deadline) return { seen: false, scanned, ignored };
     await sleep(5_000);
   }
-  return false;
 }
 
 export async function transcriptHasUserCode(path: string, code: string): Promise<boolean> {
@@ -1449,10 +1578,22 @@ function probeOmpPane(
  * that difference stated rather than papered over.
  */
 export function boundaryFromHealthz(
-  body: unknown,
+  body: string | undefined,
 ): { headline: string; detail: string[] } | undefined {
-  if (typeof body !== "object" || body === null) return undefined;
-  const boundary = (body as { boundary?: unknown }).boundary;
+  // `healthCheck` hands back the raw response TEXT, not a parsed object — the
+  // same shape `codeGraphFromHealthz` takes. Type-guarding this on `object`
+  // meant it never matched, so `status` silently fell back to probing the
+  // operator's own shell and printed "No daemon is running" at a fleet whose
+  // daemon was up. Unit tests fed it objects and agreed with themselves.
+  if (body === undefined || body.length === 0) return undefined;
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(body);
+  } catch {
+    return undefined;
+  }
+  if (typeof parsed !== "object" || parsed === null) return undefined;
+  const boundary = (parsed as { boundary?: unknown }).boundary;
   if (typeof boundary !== "object" || boundary === null) return undefined;
   const headline = (boundary as { headline?: unknown }).headline;
   if (typeof headline !== "string" || headline.length === 0) return undefined;

package/src/omp.ts

@@ -18,14 +18,7 @@ import { createServer, type Server, type Socket } from "node:net";
 import { tmpdir } from "node:os";
 import { dirname, join } from "node:path";
 
-import {
-  orchestratorConfinement,
-  orchestratorJailFromConfig,
-  worktreeConfinement,
-  type OrchestratorJail,
-  type OrchestratorRefusal,
-} from "./confinement.ts";
-import { recordConfinementRefusal } from "./confinement.ts";
+import { worktreeConfinement } from "./confinement.ts";
 import type { SessionBoundary } from "./credentials.ts";
 import { releasePolicyTripwire } from "./release-policy.ts";
 import type {
@@ -156,22 +149,6 @@ export async function createLocalSession(opts: {
   releaseGrants?: ResolvedGrants;
   /** Durable audit callback invoked only when that gate rejects a call. */
   onReleaseBlocked?: (shape: ReleaseShape) => void;
-  /**
-   * The allowlist an orchestrator session is held to (#127). Omitted, it is
-   * derived from the config on disk — which is the only honest default, since
-   * a jail that silently resolved to "no jail" would leave the roots this gate
-   * exists to close wide open on the day a caller forgot the option.
-   */
-  orchestratorJail?: OrchestratorJail;
-  /**
-   * Where an orchestrator confinement refusal is recorded. Defaults to the
-   * durable audit in the daemon's state directory — which is exactly why it is
-   * injectable: under `uid-pool` this function runs as a principal that cannot
-   * write that directory, so {@link runSessionHost} substitutes a forwarder and
-   * the *parent* performs the write. A refusal the operator never learns about
-   * is indistinguishable from a session that behaved (#127).
-   */
-  onConfinementRefusal?: (refusal: OrchestratorRefusal) => void;
   /**
    * The conductor verb socket this session's mutation tools call (#126).
    *
@@ -218,18 +195,12 @@ export async function createLocalSession(opts: {
   // transcript is the only record of what the worker actually did.
   const sessionManager = await openSessionManager(mod, opts);
   const extensions = [
-    // Two shapes, because the two sessions need different things: a worker is
-    // jailed to its checkout, while the orchestrator has to read the state
-    // directory and its briefs and is jailed to an allowlist instead (#127).
-    ...(opts.role === "worker"
-      ? [worktreeConfinement(opts.cwd)]
-      : [
-          orchestratorConfinement(
-            opts.orchestratorJail ?? orchestratorJailFromConfig(),
-            opts.cwd,
-            opts.onConfinementRefusal,
-          ),
-        ]),
+    // Workers only. The orchestrator runs unconfined by operator ruling
+    // (#143): the gate could only ever be installed in sessions this daemon
+    // spawns, so an external orchestrator — the supported shape — never had it,
+    // and a boundary that exists in one deployment out of two is not a
+    // boundary. What holds the orchestrator is its brief and the verb ledger.
+    ...(opts.role === "worker" ? [worktreeConfinement(opts.cwd)] : []),
     ...(opts.releaseGrants === undefined
       ? []
       : [releasePolicyTripwire(opts.releaseGrants, opts.role, opts.onReleaseBlocked)]),
@@ -408,8 +379,7 @@ export interface CreateSessionOptions {
   role: SessionRole;
   releaseGrants?: ResolvedGrants;
   onReleaseBlocked?: (shape: ReleaseShape) => void;
-  orchestratorJail?: OrchestratorJail;
-  onConfinementRefusal?: (refusal: OrchestratorRefusal) => void;
+
   /**
    * The OS principal and environment this session runs behind (#125). Omitted,
    * the child runs as the daemon's own user with the daemon's environment —
@@ -513,12 +483,6 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
     ...(opts.model === undefined ? {} : { model: opts.model }),
     ...(opts.resume === undefined ? {} : { resume: opts.resume }),
     ...(opts.releaseGrants === undefined ? {} : { releaseGrants: opts.releaseGrants }),
-    // Resolved here rather than in the child: the child may not be able to read
-    // the config the jail is derived from, and a jail that fell back to
-    // defaults would silently widen the gate #127 closed.
-    ...(opts.role === "orchestrator"
-      ? { orchestratorJail: opts.orchestratorJail ?? orchestratorJailFromConfig() }
-      : {}),
     ...(opts.verbSocketPath === undefined ? {} : { verbSocketPath: opts.verbSocketPath }),
   };
 
@@ -665,16 +629,6 @@ export async function createSession(opts: CreateSessionOptions): Promise<AgentSe
         case "release-blocked":
           opts.onReleaseBlocked?.(message.shape);
           break;
-        case "confinement-refusal":
-          // Performed on this side because the child may not be able to write
-          // the state directory the audit lives in. Wrapped for the same reason
-          // the in-process version is: the audit is evidence, not the gate.
-          try {
-            (opts.onConfinementRefusal ?? recordConfinementRefusal)(message.refusal);
-          } catch {
-            // A full disk must not turn a deny into an allow.
-          }
-          break;
       }
     }
   });